Before hackers break into websites with technical exploits, they usually try the oldest trick in the book: tricking a human into handing over the keys. Phishing causes more account takeovers than any other method. Learning to spot it protects your business, your accounts and your website.

Table of Contents

What Phishing Looks Like

Phishing arrives as emails, SMS, social messages and fake websites that impersonate real companies - your bank, your host, your domain registrar. The message creates urgency ('your account will be closed', 'payment failed') and pushes you to click a link and enter your credentials on a convincing fake page.

Common Types

  • Email phishing - mass fake emails with malicious links.
  • Spear phishing - personalised attacks targeting specific people.
  • SMS phishing (smishing) - fake text messages.
  • Fake login pages - look-alike sites that steal passwords.
  • Invoice scams - fake bills designed to get payments.

How to Spot It

  1. Check the sender address - the real domain, not a lookalike.
  2. Hover over links and inspect the URL before clicking.
  3. Be suspicious of urgency, threats and unexpected attachments.
  4. Look for poor grammar and generic greetings like 'Dear Customer'.
  5. Never enter passwords or payments from an email link - go to the site directly.

Protecting Your Business

  • Train yourself and your team to pause before clicking.
  • Enable 2FA on all accounts - it stops most phishing damage.
  • Use a security plugin on your website and monitor logins.
  • Keep a list of your real service URLs (host, registrar) bookmarked.
  • If unsure, call the company on its official number.

Frequently Asked Questions

I clicked a phishing link - what now?

Do not enter anything. Change that account's password immediately, enable 2FA, check for unauthorised activity, and alert your team. Quick action limits the damage.

Why do attackers target small businesses?

Because small businesses often have weaker defences and hold valuable data - payment details, client info, website access. Awareness is your cheapest, strongest defence.

Phishing exploits trust, not technology. Slow down, verify before you click, and protect your accounts with 2FA - and most attacks will bounce off you.